Menu
McDonald’s India asks users to update app after data leak report

McDonald’s India asks users to update app after data leak report

Security firm Fallible claims the app is still leaking personal information

McDonald’s India operation asked users to update their McDelivery app as a 'precautionary measure' after a security firm said it had found that it was leaking personal data of over 2.2 million users.

The Indian operation of the food chain, which is owned and managed by franchisees, said in posts on Facebook and Twitter over the weekend that its website and app do not store any sensitive financial data of users.

The operation did not admit or deny that there had been a breach, but urged users to update the online ordering app as a precautionary measure. “The website and app has always been safe to use, and we update security measure on regular basis,” according to the post.

Security firm Fallible claimed in a post Friday that the app is leaking personal data for more than 2.2 million of its users, which include their name, email address, phone number, home address and coordinates and social profile links.

It said it had contacted McDelivery with the issue on Feb 7 and received an acknowledgement from a senior IT manager on Feb 13, but there hadn’t been information about a fix from the company even after 33 days.

Fallible said “an unprotected publicly accessible API endpoint for getting user details coupled with serially enumerable integers as customer IDs can be used to obtain access to all users personal information.”

In an update, Fallible said McDonald's India had replied to the firm that they have fixed the issue and would be releasing an official statement asking users to upgrade the app, but in another update the security firm claimed that the fix was incomplete and the endpoint is still leaking data.

McDonald’s did not immediately comment over the weekend.

A user of the app, Srinivas Kodali wrote in a Twitter message that he had filed a complaint with police in Hyderabad in South India against McDonald’s under Section 43A of the country's Information Technology Act, which makes companies liable to pay damages for the compromise of sensitive personal data as a result of their failure in implementing and maintaining reasonable security practices.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments